Description

SMA Q3 is an exciting replacement for the SMA Q2 (https://hackaday.io/project/85463-color-open-source-smartwatch), with an nRF52840 and SWD pins exposed on the rear. This project aims to provide info on the Q3's hardware, as well as ensuring the Bangle.js/Espruino firmware will work on it - allowing apps to be scripted in JavaScript.

Details

This reverse engineering is based on efforts from Gordon Williams (Espruino), Fanoush, and atc1441

If you like this please consider supporting Espruino, or buying an Open Source Bangle.js watch (which will "just work")... Or contributions to improve the accuracy of info here or features of the Espruino build would be hugely appreciated.

The SMA Q3 can be a bit hard to get hold of - if there's enough interest I could sort out some kind of bulk purchase, so please let me know if so.

Specs

nRF52840 (BLE 5, 64MHz, 256kB RAM, 1MB Flash)
LPM013M126 sunlight-readable 176x176 8 color LCD, with full touch
One button, IP68 waterproof
8MB SPI Flash (XT25F64B)
GPS (AT6558)
Accelerometer (Kionix KX022)
Compass
Pressure/Temperature sensor (Bosch BMP280)
Heart rate sensor

Current State

There is a build of Espruino for the watch that exposes Bangle.js functionality to the point where some apps from the App Loader can but run. What does work:

LCD & terminal on LCD
Bluetooth
Compass, Accelerometer, Gestures
GPS
Touchscreen (X/Y not reported as an event yet)
External flash
Bootloader and firmware updates
Power saving (now 150uA normally)

What doesn't work:

Heart Rate monitor not implemented at all - while we can communicate and read data from JS, some work is needed to: adjust HRM interval, light output/sensitivity, and using the analog readings to work out HRM. If someone has any code/datasheets for the VC31 it'd be a massive help!
Pressure sensor implemented but needs some fixes/tweaking
Display could have a fake 240x240 16bpp mode to provide support for standard Bangle.js apps

The Espruino firmware can be built pretty easily with:

https://github.com/espruino/Espruino
source scripts/provision.sh SMAQ3
BOARD=SMAQ3 RELEASE=1 make flash

Pinouts

SWD - the 4 pads on the rear of the watch are GND, SWDIO/SWDCLK, VCC. The charge cable has wires for all 4 leads brought out to the USB connector, so the easiest method is just to attach wires from a USB socket to an nRF52DK

LCD - LPM013M126C

PRESSURE - BMP280, I2C 0x3C(0x1E)

TOUCH - Hynitron CST816S, I2C 0x2A(0x15)

Hynitron CST816S https://wiki.pine64.org/index.php/PineTime#Touch_panel

Can write 0x03,0xe5 to turn off

HRM - VCare VC31, I2C 0x66(0x33)

http://www.vcaresensor.com/vc31.html

No source or datasheets. Seems to produce raw ADC values

ACCEL - Kionix KX022, I2C 0x3C(0x1E)

COMPASS - I2C 0x18(0x0C) - we have it working but we don't know what it is (It's not GMC303 even though it shares the I2C address)

Pin	Connected	State
0	32876 oscillator
1	32876 oscillator
2	PRESSURE_SCL
3	Battery voltage analog GND-[1M]-D3-[3M]-VBATT
4
5	Memlcd_CS (active high)	out
6	Memlcd_EXTCOMIN Needs to be toggled at 5ms or 250ms in sleep all the time
7	memlcd_DISP 1=disp on, 0=disp off	out, pulsed high
8	Backlight	out
13 (0x0d)	Flash_MISO	input
14 (0x0e)	Flash_CS	out
15 (0x0f)	Flash_MOSI	out
16 (0x10)	Flash_SCK	in_pullup
17 (0x11)	Button	In_pullup, edge detect
19 (0x13)	Vibrate, active=1	out
21 (0x15)	HRM_POWER, active=1	out
22 (0x16)	HRM_INT
23 (0x17)	Charge port	in_pullup
24 (0x18) 25 (0x19)	HRM_SDA Charging complete
26 (0x1a)	memlcd_SCK
27 (0x1b)	memlcd_MOSI
29 (0x1d)	GPS power, active=1	out
30 (0x1e)	GPS TXD
31 (0x1f)	GPS RXD
32 (0x20)	HRM_SCL
33 (0x21)	TOUCH_SDA
34 (0x22)	TOUCH_SCL
35 (0x23)	TOUCH_RESET (active low)	out
36 (0x24)	TOUCH_INT (active low)
37 (0x25)	ACCEL_SDA
38 (0x26)	ACCEL_SCL
39 (0x27)	ACCEL_INT	input
44 (0x2c)	COMPASS_SDA
45 (0x2d)	COMPASS_SCL
47 (0x2f)	PRESSURE_SDA

Discussions

Yousef Amar wrote 01/25/2021 at 17:09

For future readers: I was able to order a sample from SMA's Alibaba page linked by @x29a (https://www.alibaba.com/product-detail/2020-Best-seller-Smart-watch-SMA_60760372855.html) with no issues and it arrived in 10 days.

Are you sure? yes | no

Matias N. wrote 01/22/2021 at 18:13

Hi again, I wanted to ask if you have an Espruino build you could share. I tried building it and it fails with lots of errors. I'm trying to figure out why the compass is not working correctly on my watch. Thanks!

Are you sure? yes | no

Gordon Williams wrote 01/25/2021 at 13:17

Can you pull and try again now? I think I just fixed the build

Are you sure? yes | no

Matias N. wrote 01/25/2021 at 20:43

Thanks. It gave some errors but eventually built the image. I managed to get into Espruino and test the compass and I think there's something not right. I'm getting:

>I2C1.writeTo(0xC,0)
=undefined
>var d = I2C1.readFrom(0xC, 1);
=new Uint8Array([128])
>I2C1.writeTo(0xC,1)
=undefined
>var d = I2C1.readFrom(0xC, 1);
=new Uint8Array([144])
>I2C1.writeTo(0xC,0)
=undefined
>var d = I2C1.readFrom(0xC, 2);
=new Uint8Array([128, 255])
>I2C1.writeTo(0xC,0)
=undefined
>var d = I2C1.readFrom(0xC, 4);
=new Uint8Array([128, 255, 255, 255])
>I2C1.writeTo(0xC,0)

Where 0x0 and 0x1 are the devid/cmpid registers which should return 0x48 and 0x05. You can also see that reading more than one byte always gives 0xFF. Should this work as is? Did you do this test and worked?

Are you sure? yes | no

Gordon Williams wrote 01/26/2021 at 08:57

Did you set up I2C1? because by default it won't be connected (software I2C is used). When trying here i get:

var i = new I2C();
i.setup({scl:45,sda:44});
i.writeTo(0xC,0);print(i.readFrom(0xC, 1)); // 130
i.writeTo(0xC,1);print(i.readFrom(0xC, 1)); // 146

So not what we'd expect for sure, but not what you get. I just tested and it seems magnetometer doesn't work for me either - so I guess it's some other device on address 0x0C. I had a quick look at the original binary and it seems to be accessing 0x3e,0x4E,0x80. This code appears to work (I'll update the firmware), but it'd be good to know what the magnetometer actually is so we can find the datasheet!

var i = new I2C();
i.setup({scl:45,sda:44});

setInterval(function() {
i.writeTo(0xC,0x4E);var d = new DataView(i.readFrom(0xC, 7).buffer);
print(d.getInt16(1),d.getInt16(3),d.getInt16(5));
// reading this register seems to kick off a new reading
i.writeTo(0xC,0x3E);i.readFrom(0xC, 1);
}, 1000);

Are you sure? yes | no

Gordon Williams wrote 01/26/2021 at 09:51

Try pulling now - just added a driver for the compass based on the reverse engineering

Are you sure? yes | no

Matias N. wrote 01/26/2021 at 14:48

Thanks a lot (replying here since HaD does not support replying to nested comments?). I actually opened my Q3 in desperation, haha. But it makes sense that it was simply not the right model. I tried to look up the chip markings and did not find anything, but it is difficult to do this kind of search.

Are you sure? yes | no

Matias N. wrote 01/10/2021 at 03:37

Hi, I'm starting to work on the Q3 and I'm having trouble communicating with I2C devices. Not sure if it is an error in my code or some pin in the table is wrong. I'm currently trying to get the touchscreen working. I'm doing the reset procedure (looked various sample codes) so it should respond. I tried communicating with other I2C devices in other pins and also seems to fail. Is there any working code for Q3 that I could look to verify the pinout?

Also, it would seem that the resistor divider has values the other way around (resulting in 1/4 not 3/4). At least that way the number I'm getting makes sense (around 4.1v fully charged).

BTW, I cannot understand why there are four I2C devices each on their own set of SDA/SCL instead of sharing pins. The fact that there are only two I2C peripherals makes this quite awkward. I think some engineer dropped the ball there.

Are you sure? yes | no

Gordon Williams wrote 01/11/2021 at 08:25

Hi, I just checked and SDA/SCL were swapped on HRM and accelerometer. The actual code Espruino uses is at https://github.com/espruino/Espruino/blob/master/boards/SMAQ3.py and it seems to work fine (pressure isn't implemented yet though).

For the battery, the table is trying to say there's a 1M resistor between GND and ADC, and 3M between ADC and power - that'd give you the 1/4 scaling you're seeing.

Pretty much all these watches seem to use software I2C - you're only transferring a few bytes and then waiting for the result, so using hardware I2C doesn't really give you any huge gains. If you've got the IO available, using separate wires makes routing the PCB a lot easier.

Are you sure? yes | no

Matias N. wrote 01/11/2021 at 15:23

Thanks a lot! I found that my issues with the touch module were due to me not using the right pin numbers for PORT1 pins (d'oh). But what you find with other devices explains also other issues I had.

Regarding the resistor ratio, you're right. I was doing 3/(1+4), so also my mistake.

BTW, on the nRF51... gitter Aaron also posted a pinout and it included a pin P1.25 which indicates charge complete. I see this is missing on the table above so it might be nice to add it.

Thanks again!

Are you sure? yes | no

Gordon Williams wrote 01/11/2021 at 15:38

Thanks! Just added pin 25 :)

Are you sure? yes | no

Matias N. wrote 01/21/2021 at 14:58

Hi, continued testing here and found that accel pins listed on this table are swapped wrt the .py script.

Also, the accel may boot with address 0x1c, and requires special reset procedure outlined in: http://kionixfs.kionix.com/en/document/TN014%20KX022,%20KX023%20Accelerometer%20Power-On%20Procedure.pdf

Very wierd

Are you sure? yes | no

Gordon Williams wrote 01/25/2021 at 13:18

Thanks - that is very interesting. I'd actually noticed that happening on some Bangle.js for some reason (literally 2 out of 6000) - good to know there's a solution though!

Are you sure? yes | no

pata wrote 11/22/2020 at 12:33

Wow thank you for all the development you are doing here :)

I'm also very interested in getting 1 or 2 of these little beasts. I've looked for them in or shipping to Europe, but so far I've had no luck.

Are you sure? yes | no

Gordon Williams wrote 11/23/2020 at 07:52

I just contacted the manufacturer direct and I can't even buy from them now. Hopefully it'll end up back in stock soon

Are you sure? yes | no

x29a wrote 12/25/2020 at 22:07

the manufacturer delivers samples via alibaba at https://www.alibaba.com/product-detail/2020-Best-seller-Smart-watch-SMA_60760372855.html - probably happy to provide higher volumes

Are you sure? yes | no

arthur_jordan05 wrote 11/21/2020 at 07:11

I'm wondering what the purpose of a gps module in a smartphone-coupled watch is. OK, maybe getting velocity, altitude and time in some sort of standalone mode , but anything else? Is it worth the higher power consumption?

Are you sure? yes | no

emeryth wrote 11/21/2020 at 12:35

So you can use the watch independently of your phone for tracking sports activity.

Are you sure? yes | no

Hồ Nguyễn wrote 11/19/2020 at 14:07

Can anybody show me where to purchase it please?

Are you sure? yes | no

emeryth wrote 11/19/2020 at 10:27

I asked around aliexpress to try to find a seller and I got this important piece of info:

> I asked the manufacturer just now. They said that there was a problem with the power-off key of this watch at present, so I can't sell it to you now. I will put it on the shelves after the manufacturer solves this problem, can I inform you?

Are you sure? yes | no

Gordon Williams wrote 11/19/2020 at 10:38

Thanks - that is very interesting. I know the watch itself does not have a 'power off' option - I guess because they figured that it was basically pointless when the watch lasted so long on a battery. But maybe that causes issues with shipping

Are you sure? yes | no

fanoush wrote 11/11/2020 at 09:53

Q3 is $30 on aliexpress today (11.11. sale) https://www.aliexpress.com/item/1005001501601570.html

Are you sure? yes | no

mik wrote 11/04/2020 at 22:06

@All: great work fleshing out the spec.

@Aaron: Checking 1MB flash = 8Mbit flash, or really 8MB?

Are you sure? yes | no

fanoush wrote 11/05/2020 at 06:53

SPI flash is really 8MB + internal flash in nRF52840 is 1MB

Are you sure? yes | no

jeffmer wrote 10/26/2020 at 22:57

Would also be very interested in getting one via a bulk purchase.

Are you sure? yes | no

Aaron Christophel wrote 10/26/2020 at 18:28

hey. The Memory is 8MB in the Q3 just as info.

Can you add this account to the contributors i am Atc1441 :)

Are you sure? yes | no

Gordon Williams wrote 10/27/2020 at 07:58

Thanks, just updated - and let me know if you didn't get an invite - still getting my head around HaD.io :)

Are you sure? yes | no

kwapiszon wrote 10/26/2020 at 13:10

i can login (sudo, etc) / unlogin (when leave keyboard) using this watch?

Are you sure? yes | no

Gordon Williams wrote 10/27/2020 at 07:59

Maybe. It can do Bluetooth HID so can send keypresses, although to log out I guess you'd need some specific software on your PC

Are you sure? yes | no

Matias N. wrote 10/26/2020 at 12:33

Thanks for publishing this, I would REALLY like to get a SMA Q3. Hopefully it becomes more widely available soon. If you decide to make a bulk purchase, count me in =)

Are you sure? yes | no

Hackable nRF52840 Smart Watch

Description

Details

Specs

Current State

Pinouts

Discussions

Similar Projects

High Efficiency MPPT Solar Charger

Color Open Source Smartwatch

OpenSource firmware for Kospet DK08 Smart Watch

MappyDot

Hackable nRF52840 Smart Watch

Become a Hackaday.io member

Just one more thing

Description

Details

Specs

Current State

Pinouts

Enjoy this project?

Discussions

Become a Hackaday.io Member

Similar Projects

High Efficiency MPPT Solar Charger

Color Open Source Smartwatch

OpenSource firmware for Kospet DK08 Smart Watch

MappyDot

Does this project spark your interest?

Report project as inappropriate

Send message

Remove Member